diff mbox series

[8/8] python3-requests: set status for CVE-2024-47081

Message ID 20260426120253.825060-8-peter.marko@siemens.com
State Under Review
Headers show
Series [1/8] harfbuzz: set status for CVE-2024-56732 | expand

Commit Message

Peter Marko April 26, 2026, 12:02 p.m. UTC 
From: Peter Marko <peter.marko@siemens.com>

NVD [1] does not have CPE set.
Debian [2] shows comit from v2.32.4 as fix.

cvelistV5 [3] also says "< 2.32.4" however for cpe psf:requests.
Not sure why this is shown in CVE metrics.

[1] https://nvd.nist.gov/vuln/detail/CVE-2024-47081
[2] https://security-tracker.debian.org/tracker/CVE-2024-47081
[3] https://github.com/CVEProject/cvelistV5/blob/main/cves/2024/47xxx/CVE-2024-47081.json

Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
 meta/recipes-devtools/python/python3-requests_2.32.5.bb | 1 +
 1 file changed, 1 insertion(+)
diff mbox series

Patch

diff --git a/meta/recipes-devtools/python/python3-requests_2.32.5.bb b/meta/recipes-devtools/python/python3-requests_2.32.5.bb
index afcf1a99b3..3477a5d83e 100644
--- a/meta/recipes-devtools/python/python3-requests_2.32.5.bb
+++ b/meta/recipes-devtools/python/python3-requests_2.32.5.bb
@@ -34,3 +34,4 @@  CVE_PRODUCT = "requests"
 BBCLASSEXTEND = "native nativesdk"
 
 CVE_STATUS[CVE-2024-35195] = "fixed-version: fixed since 2.32.0"
+CVE_STATUS[CVE-2024-47081] = "fixed-version: fixed since 2.32.4"